Crypt::Password versions through 0.28 use Perl’s built‑in rand function to construct salts for password hashes, which is deterministic and unsuitable for cryptographic use. This flaw is a CWE‑338 weakness—predictable random values—that allows every salt to be anticipated by an attacker, enabling the creation of pre‑computed hash tables for common passwords or the efficient application of rainbow‑table attacks. The resulting compromise can reveal user passwords from stored hash data, reducing the security of the entire authentication system.

Crypt::Password (DRSTEVE) for Perl 5 up to version 0.28 is affected. The project has not released a newer release since 2012.

The CVSS score of 9.8 classifies this as a high‑severity vulnerability, yet the EPSS score of less than 1% indicates that exploitation attempts are currently rare. The most likely attack vector is a post‑compromise scenario where an adversary obtains password hashes; it is inferred that such an attacker can exploit the predictable salt to rapidly test password guesses. This vulnerability is not listed in CISA's KEV catalog, implying that there is no known widespread active exploitation but the possibility remains if attackers target vulnerable systems.